# $TARGET set or op_* tmux session active → routes to /workspace/<target>/
export TARGET=10.10.10.5
cap nmap -sCV 10.10.10.5
# → /workspace/10.10.10.5/nmap_sCV.txt

# No engagement context → writes to current directory
cap nmap -sCV 10.10.10.5
# → ./nmap_sCV.txt

pipx install git+https://github.com/BLTSEC/NOCAP.git

git clone https://github.com/BLTSEC/nocap
pipx install ./nocap

# Basic capture — output goes to cwd by default
cap nmap -sCV 10.10.10.5

# Explicit subdir
cap recon gobuster dir -u http://10.10.10.5 -w /wordlist.txt
cap loot hashcat -m 1000 hashes.txt /wordlist.txt

# Custom subdir (created automatically if it doesn't exist)
cap -s pivoting chisel client 10.10.14.5:8080 R:socks
cap -s ad-enum bloodhound-python -u user -p pass -d corp.local

# Add a note to distinguish runs with the same flags
cap -n after-creds nmap -sCV 10.10.10.5
cap -n authenticated feroxbuster -u http://10.10.10.5 -x php,html

# Combined short flags
cap -an after-creds nmap -sCV 10.10.10.5    # -a and -n together
cap -aD nmap -sCV 10.10.10.5               # dry-run with auto routing

# Auto-routing: infers subdir from the tool name
cap --auto nmap -sCV 10.10.10.5       # → recon/nmap_sCV.txt
cap --auto hashcat -m 1000 h.txt wl   # → loot/hashcat_m_1000.txt
cap --auto msfconsole                 # → exploitation/msfconsole.txt

# NOCAP_AUTO=1: make auto-routing the default, no flag needed
export NOCAP_AUTO=1
cap nmap -sCV 10.10.10.5             # → recon/ automatically

# Preview routing without running
cap -D feroxbuster -u http://10.10.10.5

# Retroactive capture — forgot to cap? grab it from tmux scrollback
cap grab                                     # auto-detect last command
cap grab nmap -sCV 10.10.10.5               # explicit command
cap grab -n initial -s recon                 # with note + subdir

# Work with the last captured file
cap last                             # print the path
cap cat                              # dump to stdout
cap tail                             # follow live — watch a scan from another pane
cap open                             # open in $EDITOR / bat / less
cap rm                               # delete it
grep -i password $(cap last)
cp $(cap last) ~/report/evidence.txt

# Engagement overview
cap summary                          # timestamp, lines, size, path for all captures
cap summary passwords                # find credentials across all captures
cap summary hashes                   # find crackable hashes
cap summary ports                    # open ports from all nmap/scan output
cap summary admin                    # literal keyword search
cap ls                               # interactive fzf browser
cap ls recon                         # scoped to recon/
cap ls pivoting                      # any custom subdir works

# Update to latest
cap update

export NOCAP_WORKSPACE=/ops
export TARGET=10.10.10.5
cap nmap -sCV 10.10.10.5
# → /ops/10.10.10.5/nmap_sCV.txt

export TARGET=10.10.10.5
cap nmap -sCV 10.10.10.5
# → /workspace/10.10.10.5/nmap_sCV.txt

export NOCAP_AUTO=1
cap nmap -sCV 10.10.10.5       # → recon/ automatically
cap hashcat -m 1000 h.txt wl   # → loot/ automatically

cap --auto nmap -sCV 10.10.10.5
# → /workspace/10.10.10.5/recon/nmap_sCV.txt

cap --auto hashcat -m 1000 hashes.txt /wl.txt
# → /workspace/10.10.10.5/loot/hashcat_m_1000.txt

cap -s notes nmap -sCV 10.10.10.5
# → /workspace/10.10.10.5/notes/nmap_sCV.txt

cap last                    # print the path
cap cat                     # dump to stdout — rendered clean (no ANSI/progress noise)
cap tail                    # follow from the start — watch a running scan
cap open                    # open in $EDITOR, or rendered through less
cap rm                      # delete the capture
cap render                  # render last capture through VT100 cleaner
cap render /path/to/file    # render any capture file

# Compose last with other tools
grep -i password $(cap last)
cp $(cap last) ~/report/evidence.txt

cap summary passwords            # credential patterns (netexec, hydra, config files)
cap summary hashes               # NTLM, MD5, SHA1, SHA256 patterns
cap summary users                # username/login/account patterns
cap summary emails               # email addresses
cap summary ports                # open port lines (nmap: 80/tcp open)
cap summary vulns                # CVEs, vulnerable, exploitable, severity: critical/high
cap summary urls                 # HTTP/HTTPS URLs
cap summary admin                # literal keyword — any term
cap summary "HTB{.*}"            # regex — match HTB flags
cap summary "FLAG{[^}]+}"        # regex — generic CTF flag format
cap summary "\d+\.\d+\.\d+\.\d+" # regex — all IPs across every capture

cap ls             # all files under current engagement dir, newest first
cap ls recon       # scoped to recon/ subdir
cap ls pivoting    # any custom subdir works

# Auto-detect last command from shell history
cap grab

# Explicit command — searches scrollback for this specific output
cap grab nmap -sCV 10.10.10.5

# Works with all standard flags
cap grab -n initial                          # add a note
cap grab -s recon                            # route to subdir
cap grab -a                                  # auto-route by tool name
cap grab -n after-creds nmap -sCV 10.10.10.5 # explicit command + note

cap update

cap nmap -sCV dead:beef::1
# → nmap_sCV.txt

git clone https://github.com/BLTSEC/nocap
cd nocap
pipx install -e ".[dev]"   # installs nocap + pytest in editable mode

# or just run tests without installing:
PYTHONPATH=src pytest tests/ -v